Data Scope
Permissions answer what a user may do; data scope answers on which records. For each resource (deals, contacts, invoices, tasks…), a role can be limited to a tier of records — so a sales rep with deals:read might still only see their own deals.
The four tiers
| Tier | Records visible | Definition |
|---|---|---|
none | None | Access denied even if the capability exists (lowest rank) |
own | Records you own | You are the owner/assignee, or you created it |
team | Your team | You + your subordinates via the manager hierarchy |
all | Whole tenant | No row filter (highest rank) |
Team follows your organization’s reporting lines: a manager’s team scope covers themselves plus everyone below them in the manager hierarchy, all the way down — so make sure each user’s manager is set correctly in user/HR management.
The default tier for every role is all — scope is off until an admin narrows a specific resource. When a user holds multiple roles, the widest tier wins (none < own < team < all), consistent with additive roles.
Configure scope on a role
Open the role
Go to Settings → Roles (/settings/roles) and open the role you want to narrow.
Switch to the Data Scope tab
For each scopable resource, choose the tier — e.g. deals = own, contacts = team.
Save
Save the role. The scope applies to lists, searches, reports, and detail pages alike — the server filters rows, so out-of-scope records simply don’t appear.
Using none to revoke a resource
Setting a resource to none denies access entirely, even though the role still holds the permission — handy for quickly pulling one resource from a role without redesigning its permission set. Remember that another role granting own/team/all on the same resource will override it (widest wins); to lock something down absolutely, remove the permission itself.
What doesn’t need scope
Shared reference data (products, categories, tax codes) and company-wide settings have no per-person owner — they stay at all for everyone. Scope is for resources that naturally belong to a person or team.